Are you looking to build tools that engineers actually keep in their workflow? Do you get excited about AI agents that fix real vulnerabilities instead of writing confident nonsense about them? Are you willing to tolerate ridiculous bird puns? If you said yes to at least two of those, keep reading.

The Role
StackHawk builds the security layer for AI-assisted engineering. Our platform finds exploitable vulnerabilities in running applications and APIs, then hands the proof and the fix path directly to the coding agent already sitting in the developer’s editor. Claude Code, Cursor, Copilot, Codex. Scan, fix, verify, in a loop, without a human copying findings between tabs.

That product is real and shipping. It is also early, which means the architecture decisions that matter most have not been made yet.

We are looking for a senior engineer to own that loop. You will spend most of your time on agentic systems: the tool surfaces our agents call, the context they get, the loop that decides when a fix is actually verified, and the evals that tell us whether any of it got better this week. You will also work in the core platform, because the loop is only as good as the scan engine and APIs underneath it. This is not a research role. Everything you build goes to customers.

The team is small. Your work will be visible in the product within days, and in customer conversations within weeks.

On Denver
This role is onsite in Denver. We know that narrows the pool and we are doing it on purpose. The hard part of this work is not writing the code. It is the whiteboard argument about why the loop stopped early, the shoulder tap when an eval result looks wrong, and the twenty minutes after a customer call that turns into a design change. That happens in a room with our small team.

What You’ll Do

Design and build the find, fix, and verify loop that powers our agentic security workflows

Build and own the tool layer coding agents use to reach our platform. Some of this exists and needs a rewrite. You will have a strong opinion about how, and the room to act on it

Extend our published agent skills, which are open source and in use today

Do the context engineering work that makes the difference between a useful agent and a plausible one. Decide what the model sees, in what shape, and at what point in the loop

Build eval harnesses for non-deterministic systems. Define what "better" means, measure it repeatably, and defend the number





Build core product features and supporting services in a microservices architecture using Kotlin, Java, Rust, gRPC, Postgres, Docker, Kubernetes, and Gradle

Design and build APIs for both our UI and our customers

Build developer-facing command line tooling

Integrate with the platforms engineers already live in: GitHub, GitLab, CI systems, IDEs, and agent runtimes

Work directly with product, security, and go to market. We are small enough that you will hear customer feedback firsthand and ship against it

Learn more about vulnerability classes than you expected to, and get very good at explaining Remote OS Command Injection at parties

We move fast and this list is not exhaustive.

About You
Core experience

6+ years building and shipping production SaaS software

Deep in at least one statically typed language. Python, TypeScript, Go, or Rust experience is where our agent tooling and CLI live, so that helps immediately

Our core platform is Kotlin and Java. We do not require you to have written either. If you are strong somewhere else, you will be productive in our codebase inside a month and we are fine with that math

Experience with microservices in a contemporary cloud environment, containers, and container orchestration

Solid API design instincts and the tooling that goes with it

Obsessive about automation and automated testing

Agentic experience (this is the part we care most about)

You have built something with an agent loop, not just called an LLM API. Tool calling, multi step execution, retries, failure handling, knowing when to stop

You have written evals for non-deterministic output. You can talk about what you measured, why that metric was the right one, and what it missed

You have done real context engineering. You know that most agent failures are context failures, and you have the debugging stories to prove it

Bonus: you have built or published MCP servers, agent skills, or custom agent integrations

If your agentic experience is one weekend project and a course certificate, this is not the right role yet. If it is a system you shipped, maintained, and had to debug at 11pm,



we want to talk.

Application security
AppSec depth is a strong plus, not a requirement. If you already know your vulnerability classes cold, that will accelerate everything. If you do not, we will teach you, and you will learn faster here than anywhere else. What we do require is curiosity about how software breaks and the discipline to care about correctness. An agent that reports a fix it did not verify is worse than no agent at all.

How you work

Accountable. You own outcomes, not just tickets. When something you shipped breaks, you are already looking at it

Persuasive. You bring people to your position with logic and data, not volume

Self motivated. You do not need to be told what matters twice

Focused. You finish things before starting new things

Collaborative. You know security is a supporting function of a business, and you know the difference between binary security and security at scale

How We’ll Evaluate
No trivia and no take home that eats your weekend. Expect a working session where we look at a real agent loop problem together, talk through where it fails and how you would measure it, and dig into something you have actually built. Use whatever language you are strongest in. We are not screening for Kotlin syntax. Bring the messy version. We are more interested in how you debugged it than how it looks in the README.

The Goods

Competitive compensation. Salary plus a real equity stake in what we are building

Solid benefits . Health, dental, and vision 100% covered for employees and dependents. Life insurance, AD&D;, and 401k

Time to recharge . Take what you need, plus ten paid holidays

A great setup. Home office equipment, good tools, and a team that is fun to build with

Work that matters. StackHawk is seven years old with real customers and real revenue. The agentic product is two months old. You get the stability of the first and the blank page of the second, which is a rare combination. The decisions you make in the next few months will still be in the codebase in three years

$150,000 - $200,000 a year

StackHawk is proud to be an equal opportunity employer. We are committed to equal opportunity regardless of race, color, ancestry, religion, gender, gender identity, genetic information, parental or pregnancy status, national origin, sexual orientation, age, citizenship, marital status, disability, or Veteran status.

#J-18808-Ljbffr

📌 Senior Software Engineer, Agentic Systems (Ontario)
🏢 StackHawk
📍 Ontario